WordPress Hacked? The 7-Step Recovery Protocol (2026)

Quick answer: Hacked WordPress recovery in 7 steps: isolate the site, scan to confirm, clean or restore from a pre-infection backup, rotate every credential, reinstall core, request Google review, then harden so it doesn't happen again. Act within hours — Google blacklists fast.

Step 1-2: Isolate and Confirm

Take the site offline or into maintenance mode — a live hacked site spreads malware to visitors and gets blacklisted. Then confirm the infection: run a Wordfence scan, check for unknown admin users, look for recently modified files you didn't touch, and check Search Console's Security Issues report. Document what you find — you'll need it for cleanup.

Step 3: Clean — Two Paths

Manual cleanup means: reinstall WordPress core from wordpress.org (fresh wp-admin, wp-includes), replace plugins/themes with fresh copies from official sources, scan uploads for injected PHP, and audit the database for malicious posts and admin users. Miss one backdoor and you're reinfected within days — when in doubt, professional cleanup ($100-300) beats a second hack.

Step 4-5: Rotate Everything, Reinstall Core

Every credential changes: hosting panel, wp-admin (all users), database, FTP/SFTP, API keys, and your WordPress salts in wp-config.php (invalidates all sessions). Do it from a device you've scanned — if your laptop has the keylogger, new passwords don't help.

Step 6-7: Google Review and Hardening

Clean first, then request review in Search Console — Google re-scans in 24-72 hours. Then close the entry point: enable auto-updates, set up two-factor authentication, install a security plugin, and work through our 15-step security checklist. If the hack came through a vulnerable plugin or theme, check whether your page builder or an abandoned plugin was the vector.